In a basic desktop computing environment, a computer, accessing data from its hard drive, performs a specified function such as word processing, displaying information on a screen, and, when requested, producing a document on a connected printer. In a distributed computing environment, the resources found in the desktop environment are spread across any number of interconnected devices. For example, a client accesses a resource over the Internet. Accessing data provided by the client or located and retrieved from another device, the resource performs specified tasks. These tasks include, among a multitude of others, manipulating the data as instructed, returning the data for use by the client, and/or sending data to a printer for production.
The following provides a more specific example of a distributed computing system utilized to print documents. A client computer, utilizing a web browser and the Internet, accesses a web server providing a document printing resource. The web server may be running on a device connected to or networked with one or more printers. Alternatively, the web server may be embedded in the printer itself. The printing resource locates available printers and a data resource managing electronic documents. The printing service then returns to the browser a graphical interface containing user accessible controls for selecting a document from the data resource as well as controls for selecting a printer. Selections made through the interface are returned to the printing resource. Accessing the data resource, the printing resource retrieves and/or sends the selected document to the selected printer for production.
Accessing distributed resources raises a number of security considerations. Access to a resource may be limited for commercial or privacy purposes. Using the example above, a user may be a paid subscriber enabling access to the printing resource. The user may pay a flat rate or may pay for each use. For commercial security, the user may be required to present credentials such as a user name and password in order to access the printing resource. The same may be true for the data resource. However, presenting credentials to the data resource also promotes user privacy. A user may store documents on the data resource that the user desires to keep private and secure.
Network communications can be intercepted. Where an intercepted communication is a request to access a resource that includes a user's credentials, that communication can be resubmitted to a resource at a later time without the user's knowledge or consent. This resubmission is commonly referred to as a replay or playback attack. Because the resubmission includes verifiable credentials, access to the resource is granted. Existing methods for preventing replay attacks involve routinely changing a user's credentials. However, such changes inconvenience the user who is required to continually remember new passwords.